RE: I-D ACTION:draft-schaad-dhsign-00.txt

["Jim Schaad (Exchange)" <[e-mail]>]

Eric,

It appears that I need to get a new set of reviews as they all missed this.
I think you are correct and there is a problem in the draft.  I currently
plan to remove the ephermal scheme from the draft on the next revision.

jim


-----Original Message-----
From: EKR [mailto:[e-mail]]
Sent: Friday, November 13, 1998 3:47 PM
To: Jim Schaad (Exchange)
Cc: IETF-PKIX (E-mail)
Subject: Re: I-D ACTION:draft-schaad-dhsign-00.txt


"Jim Schaad (Exchange)" <[e-mail]> writes:
> This draft is referenced from the new CMC draft so it should be of
interest
> to the readers of that draft.
Jim, 
First, a meta-comment:
Why do we need this at all? DH keys are suitable for computing
DSA signatures. Wouldn't it be simpler just to compute a DSA
signature over the data? This would eliminate the need for a common
group between the sender and recipient.

Secondly, I don't believe that the ephemeral scheme is strong.
Provided that the attacker has access to the triplet
g,p,Ys (sender's public key), it's trivial for him to compute
a private key Xe such that he knows:
  
Ye^Xe = g^(XsXe) 

This allows him to forge any number of signed messages
Remember, computing the DH shared secret requires access
to only one of the DH private keys.

I hesitate to bring this up because I'm sure I'm missing something
really obvious, but I sure can't see what it is.

Confused,
-Ekr

-- 
[Eric Rescorla                                   [e-mail]]